This post describes how to configure a Branch Office VPN (BOVPN) between WatchGuard Firebox on Prem and a Check Point device at my home which is behind my home router.

There are some configuration I found interesting which I mentioned in the following. Local network setting is confusing me although I got it working. It might be because of the specialty of Firebox


Make Sure Firewalls UDP500 Expose to Internet

UDP500 is IPSEC Protocol. 

Since in local site, I am having a home router in front of Checkpoint firewall, I will have to open UDP 500 port to checkpoint firewall gateway. 

Create Gateway on each site

1  On CheckPoint Firewall, create a new Interoperable device:

You also can create a VPN Community to add both gateways into settings:

2  On WatchGuard, create a new Branch Office Gateway:

Under the Credential Method section, select Use Pre-Shared Key and enter a same key as you entered in the Checkpoint firewall.

Create Phase 1 (Main) Policy

1  On CheckPoint Firewall,

2  On WatchGuard, 

In this Lab, I am using SHA1 and AES128 with DH Group 2.

Create Phase 2 (Quick) Policy

1  On CheckPoint Firewall,

2  On WatchGuard, 

In this Lab, I am using SHA256 and AES256 with DH Group 14.

One thing I found interesting is to set up local ip. If I set a local route172.x.x.0/24 this kind of network, the tunnel will be failed.  With one static ip could not find route.
If I set it to 172.x.x.x/32 or Any IPv4, the tunnel comes up right away. Strange. 

Default Phase2 Proposal can be changed at VPN menu -> Phase 2 proposals page. 

Create Firewall Policy to Allow VPN Traffic

1  On CheckPoint Firewall,

2  On WatchGuard, it will automatically add two BOVPN rules for inbound and outbound traffic:

Test and Troubleshooting

1  On CheckPoint Firewall,
  • Ping, tracert, VPN tu, and tcpdump -nni any host <Remote VPN Gateway Public IP>
  • Logs to search <Remote VPN Gateway Public IP>

2  On WatchGuard, 

WatchGuard System Manager to reset key and clear error message

Firebox System Manager – Right Click Menu on Gateway – VPN Diagnostic Report

System Manager – Traffic Monitor


from Blogger

By Jon

Leave a Reply